Japan Exposes Years of Cyber Attacks: Chinese Hackers Target Government and Tech Firms
The Japanese government has recently issued an alert regarding a significant cybersecurity threat from a Chinese hacking group, known as MirrorFace. This group has been targeting various government entities, corporations, and individuals across Japan since 2019, raising serious concerns about national security and technological advancements.
Details of the Cybersecurity Threat
According to the National Police Agency and the National Center of Incident Readiness and Strategy for Cybersecurity, the MirrorFace hacking campaign is organized and appears to have connections to China. The primary aim of this group is to steal sensitive information related to Japan’s national security and advanced technologies.
Targets of the MirrorFace Campaign
The extensive alert highlighted that the targets of these cyberattacks included:
- Japan’s Foreign and Defense Ministries
- The country’s space agency
- Politicians and journalists
- Private companies and tech think tanks
As reported by the Associated Press, the hacking spree has evolved over the years. A blog post by Japan’s Computer Emergency Response Team Coordination Center (JPCERT/CC) indicated that MirrorFace initially focused on media, political organizations, think tanks, and universities. However, their targets have shifted towards manufacturers and research institutions since 2023.
Methods Employed by MirrorFace
In a 2022 report, the cybersecurity firm ESET detailed a spearphishing email campaign executed by MirrorFace. This campaign primarily targeted Japanese political entities and specific politicians ahead of the elections. Notably, it was found that MirrorFace does not have apparent ties to other known Chinese government hacking groups.
Types of Cyber Attacks
The alert disclosed that MirrorFace employed spearphishing techniques in their multi-year campaign, which included:
- 2019-2023: Targeted individuals working for think tanks, active and retired politicians, and journalists.
- 2023-Present: Focused on internet-connected network devices within companies in sectors such as semiconductor, manufacturing, information and communications, academia, and aerospace.
- June 2024: Launched attacks aimed at academics, think tanks, politicians, and media personnel in Japan.
Implications for Japan’s Cybersecurity
Japan’s unique pacifist constitution has resulted in limited capabilities in cyberspace, according to experts. A report by The Washington Post revealed that the U.S. National Security Agency had uncovered in 2020 that Chinese military hackers compromised some of Japan’s most sensitive classified defense networks.
This ongoing threat from MirrorFace underscores the necessity for enhanced cybersecurity measures in Japan, particularly in protecting vital national interests and sensitive information.
